action to bump actions versions

[kelly-sovacool]

Composite action will:

• read the workflow files in .github/workflows/
• for each action, go to the action repo and determine the latest version
• if there is a new latest version, consider changing the version used in the workflow:
  • respect sliding tags if they are used (e.g. if a workflow specifies v7 and there is a v8.0.0, bump to the v8 sliding tag)
  • if the tag used is "latest" i.e. already points to the most recent tag, keep it as-is
  • use a special comment so users can skip version bumps if desired. e.g.
    - uses: actions/checkout@v5 # ccbr_actions:lock-version -- the version would not be bumped by this action
• open a PR with the updated version. respect conventional commits guidelines. use the CCBR bot to generate a token as the commit author and PR owner.

Example workflow will:

• run on a schedule (monthly?)
• run actions/checkout
• run the composite action